Make WordPress Core

Changeset 53092


Ignore:
Timestamp:
04/07/2022 12:52:32 PM (2 years ago)
Author:
SergeyBiryukov
Message:

Administration: Restore the correct escaping function for base64-encoded SVG icons in the admin menu.

Add a comment to clarify the esc_attr() usage instead of esc_url().

Follow-up to [53050].

Props KProvance, kebbet, w33zy, ocean90, mukesh27.
Fixes #55539.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/wp-admin/menu-header.php

    r53061 r53092  
    129129                $img = '<br />';
    130130            } elseif ( 0 === strpos( $item[6], 'data:image/svg+xml;base64,' ) ) {
    131                 $img       = '<br />';
    132                 $img_style = ' style="background-image:url(\'' . esc_url( $item[6] ) . '\')"';
     131                $img = '<br />';
     132                // The value is base64-encoded data, so esc_attr() is used here instead of esc_url().
     133                $img_style = ' style="background-image:url(\'' . esc_attr( $item[6] ) . '\')"';
    133134                $img_class = ' svg';
    134135            } elseif ( 0 === strpos( $item[6], 'dashicons-' ) ) {
Note: See TracChangeset for help on using the changeset viewer.